Extracted

• • Target

    Sigmanly_05c3a97a89c7c65375215bcc8570036e33121faa2a5cfda0824ea35b459db625

  • Size

    2.8MB

  • MD5

    83b07f60a8699948f2b590eb4742634b

  • SHA1

    5a8cd1fa7c145090212d9eeea1356768045d1429

  • SHA256

    05c3a97a89c7c65375215bcc8570036e33121faa2a5cfda0824ea35b459db625

  • SHA512

    ab987eab6619ccfda4b8ae54ab94a1d27081d241813eb1c94f681df6888b2bd399bf75f514ff6df57780220b17e899f16622ed4481fda423656f3658719c5030

  • SSDEEP

    49152:DbLO7/J4s27weBWppYKAnTm1SDh3zSleqNNkqcyK1zb:DbCV4s27MpWKedSlrbcNp

  Score

  10^/10

  lummadiscoveryevasionstealer

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2